CDPSE Practice Test 6 — 10 Questions

Question 1

You are designing a system for k-anonymity. If a dataset has an identifier that is unique to every row, what is the first step you must take before applying generalization?

Accepted Answer

Apply suppression to direct identifiers. Before generalization can produce meaningful equivalence classes, direct identifiers (names, SSNs, email addresses) that uniquely identify each row must be removed or suppressed. If a unique direct identifier remains, every row stays distinguishable regardless of how much you generalize quasi-identifiers, defeating k-anonymity. Suppression of direct identifiers is therefore the mandatory first step in the standard k-anonymity pipeline (remove direct identifiers, then generalize/suppress quasi-identifiers).

Answer

Add synthetic noise

Answer

Normalize the dataset

Answer

Increase the k-value

Question 2

What does a 'Privacy-Enhancing Technology' (PET) primarily aim to achieve?

Accepted Answer

Minimizing or protecting personal data. Privacy-Enhancing Technologies (PETs) are a class of technical measures designed to protect personal data throughout its lifecycle by minimizing collection, limiting linkability, and reducing identifiability. Their core objective is to enable data processing while safeguarding individual privacy, not to improve infrastructure performance. Options like processing power, bandwidth, and software quality are unrelated to the privacy purpose of PETs.

Answer

Increasing processing power

Answer

Improving network bandwidth

Answer

Reducing software bugs

Question 3

Which document should a CDPSE practitioner review first when establishing a new privacy governance program?

Accepted Answer

The existing business strategy and risk appetite.. A privacy governance program must be aligned with the organization's strategic direction and risk tolerance, so the first document to review is the existing business strategy and risk appetite. This establishes why the program exists, what business outcomes it must support, and how much privacy risk leadership is willing to accept. Without that context, a practitioner cannot prioritize regulatory obligations, allocate resources, or define meaningful metrics.

Answer

The list of current vendors.

Answer

The software inventory.

Answer

The technical architecture diagram.

Question 4

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

Accepted Answer

It identifies privacy risks at each stage from collection to deletion.. Data Lifecycle Management (DLM) is significant in privacy risk assessments because it provides a structured framework to identify privacy risks at every stage of data handling — from collection, use, storage, sharing, to deletion. By mapping risks to each lifecycle phase, organizations can ensure controls are applied where they are most needed, such as consent at collection or secure deletion at end-of-life.

Answer

It reduces the power consumption of the storage systems.

Answer

It determines the software development methodology.

Answer

It ensures that the database is always updated with the latest patches.

Question 5

Which of the following is the most effective technical control for implementing the 'Right to be Forgotten' in a distributed microservices environment?

Accepted Answer

Implementing a centralized 'Identity Deletion' event bus. In a distributed microservices environment, personal data is scattered across many services and data stores, so honoring erasure requires coordinated action. A centralized 'Identity Deletion' event bus publishes a deletion event that each subscribing service consumes to erase or anonymize its copy of the subject's data, providing a scalable, auditable, and consistent mechanism. This event-driven pattern ensures no service is missed and creates a traceable record of propagation.

Answer

Deleting individual database records in each service

Answer

Archiving logs for 7 years

Answer

Increasing database logging levels

Question 6

To prevent 're-identification' of an anonymized dataset, what process should be applied if the dataset is merged with external public data?

Accepted Answer

Linkage attack analysis. A linkage attack analysis specifically evaluates whether an anonymized dataset can be re-identified by joining it with external public data using shared quasi-identifiers such as ZIP code, birth date, or gender. It is the process designed to detect and mitigate re-identification risk before or after data merging. This directly addresses the scenario of combining anonymized data with external sources.

Answer

Data validation

Answer

Backup encryption

Answer

Database normalization

Question 7

In the context of data classification, which metadata field is most critical for determining the disposal date?

Accepted Answer

Retention Start Date. The Retention Start Date is the most critical metadata field for determining the disposal date because it marks when the retention period begins. Retention policies typically specify a duration (e.g., 7 years) from a trigger event, and the Retention Start Date provides that trigger. Without it, the disposal date cannot be accurately calculated.

Answer

Data Owner

Answer

Encryption Key ID

Answer

Classification Label

Question 8

Which role is primarily responsible for ensuring that privacy policies are communicated effectively across the organization?

Accepted Answer

The Privacy Office or DPO.. The Privacy Office or Data Protection Officer (DPO) owns the privacy program and is accountable for drafting, approving, and disseminating privacy policies to all workforce members and relevant stakeholders. This role translates regulatory requirements (GDPR, CCPA, HIPAA) into operational policy and ensures consistent communication through training, awareness campaigns, and acknowledgments. Communication effectiveness is a governance responsibility, not an IT or audit function.

Answer

The janitorial staff.

Answer

The external auditors.

Answer

The IT helpdesk.

Question 9

A multinational corporation's privacy team is struggling to keep pace with new privacy laws across 20 countries. The chief privacy officer wants to shift from a reactive to a proactive governance model. Which initiative would BEST enable this transformation?

Accepted Answer

Implement a privacy management platform that tracks regulatory changes and automates assessments.. Implementing a privacy management platform best enables a proactive governance model by automating regulatory tracking, assessments, and reporting across multiple jurisdictions. It provides scalability and real-time visibility, allowing the privacy team to anticipate and respond to changes efficiently, rather than reacting after the fact.

Answer

Conduct an annual global privacy audit to identify gaps after laws take effect.

Answer

Hire additional privacy lawyers in each country to monitor legislative changes.

Answer

Delegate privacy compliance to local business units without central oversight.

Question 10

A privacy engineer is implementing a consent management platform for a mobile application. The platform must capture, store, and enforce user consent preferences across multiple microservices. Which two actions should the engineer take to ensure consent is technically enforceable and auditable? (Choose two.)

Accepted Answer

Store consent records with a timestamp, version of the privacy notice, and the specific purposes consented to.. To make consent technically enforceable and auditable, the engineer must both record granular consent details (timestamp, notice version, purposes) and enforce those preferences at the point of processing within each microservice. Recording alone does not prevent processing, and enforcement without a reliable record lacks proof. Together, they create a robust consent management system that supports compliance and user rights.

Answer

Encrypt consent records using a symmetric key stored in the application code to prevent tampering.

Answer

Rely on the mobile operating system's permission prompts as the sole mechanism for capturing consent for all data processing purposes.

Answer

Allow users to change their consent preferences only through a customer support ticket to maintain a controlled audit trail.